# Root CA for IOT **URL:** \ **Category:** Help\ **Created:** [January 25, 2021, 4:13pm UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612 "2021-01-25T16:13:23Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![danny1](https://avatars.discourse-cdn.com/v4/letter/d/eb9ed0/32.png) [@danny1](https://community.letsencrypt.org/u/danny1)\ **Post date:** [January 25, 2021, 4:13pm UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/1 "2021-01-25T16:13:23Z")
hi my ssl certificate expires on 15 march .i had renewed it on 15 december. i have read in a blog that lets encrypt is switching to new CA root .. i want ask when will this happen. if i renew my certificate now will i be able to use new root CA for my IOT application ? (will this new Root CA be valid for next 20 years?) ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [January 25, 2021, 4:32pm UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/2 "2021-01-25T16:32:30Z")
Hi @danny1 see > **[Chain of Trust - Let's Encrypt - Free SSL/TLS Certificates](https://letsencrypt.org/certificates/)** > > Last updated: Jan 20, 2021 > Root Certificates Our roots are kept safely offline. We issue end-entity certificates to subscribers from the intermediates in the next section. For additional compatibility as we submit our new Root X2 to various root... The old intermediate certificate - that's the X3. The new is the R3, based on the X1. So check, if the X1 is imported. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 25, 2021, 5:14pm UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/3 "2021-01-25T17:14:53Z")
> [@danny1](#): > > will this new Root CA be valid for next 20 years? As you can see from the Chain of Trust document linked by @JuergenAuer, the currently used ISRG Root X1 is valid until a date in 2035 and the upcoming ISRG Root X2 (ECDSA) is valid until a date in 2040. So both roots will not be valid for the next 20 years (X2 is a year short 😛). ---
**Author:** ![danny1](https://avatars.discourse-cdn.com/v4/letter/d/eb9ed0/32.png) [@danny1](https://community.letsencrypt.org/u/danny1)\ **Post date:** [January 26, 2021, 3:02pm UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/4 "2021-01-26T15:02:24Z")
Hi Thank you for your useful answer ---
**Author:** ![danny1](https://avatars.discourse-cdn.com/v4/letter/d/eb9ed0/32.png) [@danny1](https://community.letsencrypt.org/u/danny1)\ **Post date:** [February 4, 2021, 11:56am UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/5 "2021-02-04T11:56:05Z")
hello thank you for your useful reply ... R3 is based on ISRG X1 ..so when i download the .pem file from R3 this means that this root certificate is valid untill 2035? kindly help me in this matter i am confused. when i click on my certificate details in morzrilla fox ...i see 3 certficates my domain, R3 , and DST Root CA X3.. which one should i download i am confused.... because R3 and DST Root CA X3 says validity untill Oct-2021... but you told R3 is valid untill 2035.... all i can download is .pem file.. Response will be highly appreciated ---
**Author:** ![danny1](https://avatars.discourse-cdn.com/v4/letter/d/eb9ed0/32.png) [@danny1](https://community.letsencrypt.org/u/danny1)\ **Post date:** [February 4, 2021, 11:56am UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/6 "2021-02-04T11:56:31Z")
HI R3 is based on ISRG X1 ..so when i download the .pem file from R3 this means that this root certificate is valid untill 2035? kindly help me in this matter i am confused. when i click on my certificate deatils in morzrilla fox ...i see 3 certficates my domain, R3 , and DST Root CA X3.. which one should i download i am confused.... because R3 and DST Root CA X3 says validity untill Oct-2021... but i am told R3 is valid untill 2035.... all i can download is .pem file.. Response will be highly appreciated ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [February 4, 2021, 12:00pm UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/7 "2021-02-04T12:00:47Z")
> [@danny1](#): > > when i click on my certificate deatils in morzrilla fox ...i see 3 certficates my domain, R3 , and DST Root CA X3.. which one should i download i am confused Your domain name is required if you want help. I don't see a problem. There is no need to download root certificates. PS: Read > **[Chain of Trust - Let's Encrypt](https://letsencrypt.org/certificates/)** > > Root Certificates Our roots are kept safely offline. We issue end-entity certificates to subscribers from the intermediates in the next section. For additional compatibility as we submit our new Root X2 to various root programs, we have also... PPS: Oh, already shared. So you know all you need. ---
**Author:** ![danny1](https://avatars.discourse-cdn.com/v4/letter/d/eb9ed0/32.png) [@danny1](https://community.letsencrypt.org/u/danny1)\ **Post date:** [February 4, 2021, 11:21am UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/8 "2021-02-04T11:21:54Z")
hello my question is R3 is based on ISRG X1 ..so when i download the .pem file from R3 this means that this root certificate is valid untill 2035? kindly help me in this matter i am confused. when i click on my certificate deatils in morzrilla fox ...i see 3 certficates my domain, R3 , and DST Root CA X3.. which one should i download i am confused.... because R3 and DST Root CA X3 says validity untill Oct-2021... but i am told R3 is valid untill 2035.... all i can download is .pem file.. Response will be highly appreciated ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [February 4, 2021, 11:38am UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/9 "2021-02-04T11:38:32Z")
You should never need to serve a root certificate. No one should ever accept root certs from random web servers either. R3 is an intermediate certificate - and it should be served with your _leaf_ cert. If you use certbot, the `fullchain.pem` will always contain the leaf and intermediate(s). As for the expiration dates, each cert has its' own expiration. The root is always the longest expiration. It issues certs to the intermediates to authorize them - those will always expire before the root does. Then the intermediates _do all the work_ and sign all the certs that we all use on our webservers, etc. Those certs will expire in 90 days [far less life than the intermediates]. ---
**Author:** ![danny1](https://avatars.discourse-cdn.com/v4/letter/d/eb9ed0/32.png) [@danny1](https://community.letsencrypt.org/u/danny1)\ **Post date:** [February 4, 2021, 11:48am UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/10 "2021-02-04T11:48:00Z")
Thank you for your useful reply.. i am developing an IOT application and for that i need to use root certificate.. i cant use simple ssl fingerprint as you mentioned it expires very soon. so i am downloading root certificate to validate the https and it works fine as i do not have to update firmware often.. but my question was, i see three different .pem file and they all look different to me .. which one should i download to have longer validity ---
**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\ **Post date:** [February 4, 2021, 12:03pm UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/11 "2021-02-04T12:03:19Z")
if then you should use your own CA as backup ( keep the key in safe) and root certificate isrg root x1 ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [February 4, 2021, 12:04pm UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/12 "2021-02-04T12:04:48Z")
I don't think you understand how encryption works. OR I don't quite understand what your asking. The useful cert lasts only 90 days. It will expire and must be renewed [replace by new cert]. That file is the `cert.pem` file. The intermediate cert can be found alone in the `chain.pem` file. OR combined with the `cert.pem`[+`chain.pem`] in the `fullchain.pem`. Which is the file that most modern systems use for encryption. There is also the `privkey.pem` which is the [only] private key that can decrypt anything that was encrypted with your public key [found in your public cert = `cert.pem`]. If you are trying to PIN a trusted certificate, do not PIN the `cert.pem` nor the `chain.pem`; as both can or do change very frequently. You should only PIN the root, but that is not provided in any of those `.pem` files; as it can be found in any modern certificate store [which is where everyone should get their root certs from]. Also, when PINning you should always PIN an extra self-signed cert that you control - as a secondary safety measure in the event the root cert expires or is for whatever reason no longer trusted. [never put all your eggs in one basket] Cheers from Miami 🍻 ---
**Author:** ![danny1](https://avatars.discourse-cdn.com/v4/letter/d/eb9ed0/32.png) [@danny1](https://community.letsencrypt.org/u/danny1)\ **Post date:** [February 4, 2021, 12:44pm UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/13 "2021-02-04T12:44:05Z")
do you have basic understaning of IOT systems? ---
**Author:** ![danny1](https://avatars.discourse-cdn.com/v4/letter/d/eb9ed0/32.png) [@danny1](https://community.letsencrypt.org/u/danny1)\ **Post date:** [February 4, 2021, 12:44pm UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/14 "2021-02-04T12:44:48Z")
It seems to me you do not understand my question ...if yes no need to answer ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [February 4, 2021, 12:45pm UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/15 "2021-02-04T12:45:57Z")
I guess we are agreed: > [@rg305](#): > > I don't quite understand what your asking. ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [February 4, 2021, 1:04pm UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/16 "2021-02-04T13:04:55Z")
> [@danny1](#): > > It seems to me you do not understand my question Your question is already answered. > [@Root CA for IOT](https://community.letsencrypt.org/t/root-ca-for-iot/143612/2): > > H… All done. ---
**Author:** ![danny1](https://avatars.discourse-cdn.com/v4/letter/d/eb9ed0/32.png) [@danny1](https://community.letsencrypt.org/u/danny1)\ **Post date:** [February 4, 2021, 1:10pm UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/18 "2021-02-04T13:10:55Z")
I hope you understand what i mean ---
**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\ **Post date:** [February 4, 2021, 2:28pm UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/20 "2021-02-04T14:28:39Z")
What CAs that device will trust? It has entire ca-certificates that has all the public trusted CA (what version then?) Or you pined some CA keys? If pinned what keys? (Tell hash of publickey not name as there are multiple X3 here DST root X3 is root, letsencrypt X3 is intermediate ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [February 4, 2021, 6:16pm UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/21 "2021-02-04T18:16:51Z")
If it worked and then suddenly stopped working... ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/b/e/be364b13fc808594b3e4de220c31c647b46b3258.png) Then you must have been pinning the intermediate cert [which has recently changed] If so, then you need to understand why pinning an intermediate is a very risky thing [and NOT recommended]. If it has never worked, then we may be talking about a whole different problem. ---
**Author:** ![danny1](https://avatars.discourse-cdn.com/v4/letter/d/eb9ed0/32.png) [@danny1](https://community.letsencrypt.org/u/danny1)\ **Post date:** [February 10, 2021, 9:32am UTC](https://community.letsencrypt.org/t/root-ca-for-iot/143612/22 "2021-02-10T09:32:50Z")
![cert2](https://global.discourse-cdn.com/letsencrypt/original/3X/2/6/26e701b79e602d90525c267b3f92096956bccda1.png) ![certificate](https://global.discourse-cdn.com/letsencrypt/original/3X/1/c/1c216de171b6650710b447e08ff13a3004fbee55.png) This is my problem i still see old root how can get new ISRG X1 root?? [Next page](https://community.letsencrypt.org/t/root-ca-for-iot/143612.md?page=2)